VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Jan 13, 2021· Updated Jun 17, 2026

CVE-2021-21012

CVE-2021-21012

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the checkout module. Successful exploitation could lead to sensitive information disclosure.

Affected products

10
  • Adobe Inc./Magentollm-fuzzy
    Range: <=2.4.1, <=2.4.0-p1, <=2.3.6
  • Adobe Inc./Magento Commercecpe-rescue5 versions
    unspecified+ 4 more
    • (no CPE)range: unspecified
    • cpe:2.3:a:adobe:magento_commerce:*:*:*:*:*:*:*:*range: <=2.3.6
    • cpe:2.3:a:adobe:magento_commerce:2.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:magento_commerce:2.4.0:p1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:magento_commerce:2.4.1:*:*:*:*:*:*:*
  • Adobe Inc./Magento Open Source4 versions
    cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*range: <=2.3.6
    • cpe:2.3:a:adobe:magento_open_source:2.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:magento_open_source:2.4.0:p1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:magento_open_source:2.4.1:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.